Blog

The PowerSchool Data Breach: What Districts Can Do to Protect Students and Support Parents

by iSphere on January 27, 2025 in Blog, Cybersecurity, Education Sector Content, Education Technology Solutions

There’s one goal that unifies teachers, district staff, and parents—and it’s helping children achieve a brighter future.

That’s why educators, entrusted with sensitive student information, are so frustrated by the PowerSchool data breach. Bad actors appear to have used stolen credentials to access the internal customer support portal and compromise the secure student information system (SIS). Then, the hackers were able to extort the K-12 software provider for an undisclosed amount in exchange for keeping the following data for as many as 60 million students “private”:

Names
Addresses
Social Security Numbers
Medical Information
Grade Information
And More

Though the PowerSchool team is confident the hackers won’t use the information, we’re not so certain. That’s why we’ve put together some thoughts on how school districts can mitigate the fallout and better prepare educators and parents to protect student data privacy.

Key Takeaways

Breach Overview: Hackers accessed PowerSchool systems, exposing sensitive data for up to 60 million students.
District Actions: Audit cybersecurity, limit data collection, and partner with trusted edtech providers.
Parent Guidance: Reset passwords, freeze children’s credit scores, and watch for phishing attempts.
Data Minimalism: Collect only essential student information to minimize risks.
Transparency Matters: Provide clear resources to help parents protect their children.

Review Your Cybersecurity ASAP

Cyberattacks often cascade. Hackers can parlay one breach into numerous others, which we’ve seen most notably in the news when Russian cybercriminals used the SolarWinds breach to access data and systems of hundreds of companies and dozens of government agencies. So, if you know a third-party vendor has been compromised, audit your cybersecurity immediately. No exceptions.

What should your cybersecurity or breach response team review? Here are a few essential elements to triple check for security:

Access Controls – If hackers have sneaked into your system, there’s a chance they’ll try to create illegitimate permissions to gain deeper access. Verify only authorized users have administrator access (and reduce privilege creep while you’re at it).
Server Connections – Are there unusual traffic patterns in the wake of a data breach? Are there surges in traffic? Are uncommon communication protocols being used? These or other anomalous behaviors can mean that hackers have attempted to exfiltrate data.
Connected Apps and APIs – With the PowerSchool breach, school districts need to make sure to evaluate other systems and applications that share data with and retrieve data from the SIS. If the application program interfaces (APIs) for accounting programs, attendance tools, communication software, or other third-party tools are not secure, then the catastrophe might spread.

Unfortunately, only trained cybersecurity experts will be able to evaluate these systems and platforms in an incisive way that uncovers foul play. Even then, they typically need a pre-data-breach baseline to compare against the current state, if they’re going to make accurate diagnoses.

Limit the Data You Collect

Sometimes, school districts get overzealous about data collection. Well-meaning administrators or IT leaders envision a sea of hypothetical scenarios to enhance student interactions, operational efficiency, or the overall learning experience. We get it, data is exciting. In the process, they overconfidently collect sensitive information that can pad the coffers of cybercriminals after they’ve sold it on the dark web.

School districts are best served adopting a mindset of data minimalism. Think of the Marie Kondo method but even more spartan. Any piece of data that school districts gather or require students to submit should serve a clear and essential purpose. This approach not only reduces risks but also demonstrates to parents that the district prioritizes student privacy.

If you’re not sure which information you should avoid storing, here are some types of data which we’d advise against using (when possible):

Social Security Numbers – In most cases, a student identification number should suffice for tracking, management, and security.
Biometric Information – Some districts have contemplated using fingerprint scanners, face recognition cameras, and other biometrics to authenticate and track student activities. Yet if this data is stolen, students’ identities and futures can be jeopardized in unprecedented ways.
Social Media Accounts – Student activity monitoring is often proposed to combat cyberbullying, identify mental health risks, and intervene to keep the student body safe. However, this data, if compromised, can give criminals and predators a short cut to target vulnerable students.

When in doubt, turn to privacy experts or resources for further guidelines on the types of data that your district should avoid collecting.

Give Parents Guidance on Next Steps to Protect Students

There is only so much you can do to try to protect students in the aftermath of a data breach. Parents and guardians have more authority to take direct action that can better safeguard their child’s identity, but you must be completely transparent about the threat so they can take those actions. Discussing school data breaches is not pleasant, but knowledge is power for parents as much as it is for students.

What do parents need to do immediately? Here is what some edtech security experts recommend:

Encourage Password Resets – First and foremost, instruct parents and guardians to reset any district-related passwords. Hackers appear to have access to the PowerSchool customer support portal, so you should just assume all those login codes are untrustworthy. Plus, it doesn’t hurt to remind them to reset their other passwords (especially if they recycle passwords 😐).
Freeze Their Child’s Credit Score – Since students don’t typically have much credit history, their SSNs are appealing to fraudsters. Whether opening credit cards, taking out auto loans, or perpetrating other schemes, cybercriminals can ruin students’ futures before they even start. Equifax provides some useful guidance on the steps you need to take to freeze credit scores and restrict access after breaches.
Watch for Phishing Attempts – If email addresses were compromised, expect a rise in phishing attempts after this breach. Parents and guardians should double-check the authenticity of every email or text they receive about their students. If they are directed to download anything suspicious or provide unexpected payment information, it doesn’t hurt to verify that request with a trusted member of the district administration. Yes, it creates more work, but it goes a long way to building much needed trust.

Providing these and other resources in an easily accessible FAQ page or support hotline can empower parents to act quickly and efficiently while time is on their side.

Collaborating with the Right EdTech Partner

Your school district’s cybersecurity is only as good as its weakest link. Partnering with the right education technology solutions provider is absolutely essential to ensure security protocols are satisfied, compliance audits are conducted, and threats are rapidly addressed. Vendors should be working as hard as your team to keep data secure, private, and compliant.

We’ll go a step further. Unless a provider can articulate how they’ll safeguard the safety of the students, families, staff, and communities you serve, you need to take your business elsewhere.

iSphere is experienced at striking that balance. We not only prioritize innovation but also build trust with communities and protect the privacy of students. That way, we mitigate the risk of threats like the PowerSchool data breach and respond quickly to remedy issues, so students and families don’t need to sacrifice their safety for an education.